Executive Order 14409: Promoting Advanced Artificial Intelligence Innovation and Security
Issued by
White House (Executive Office of the President)
- September 30, 2026 · Correction — Corrected the signing date (2 June 2026) and made clear that early access is voluntary. (Cody Maxwell)
- September 30, 2026 · Correction — Restated the order as voluntary at both stages, with access of up to 30 days before release to trusted partners and no penalties (fact-check finding). (Cody Maxwell)
- October 1, 2026 · Correction — Typed as an executive order, a new directory category. (Cody Maxwell)
- October 1, 2026 · Correction — Named the order by its number. (Cody Maxwell)
- October 1, 2026 · Correction — Rewrote the practical steps, newsletter hook, search description, and audience fields to match the entry's corrected content. (Cody Maxwell)
This executive order, signed on 2 June 2026, sets up a classified process for assessing frontier AI models' cyber capabilities. Developers of models designated as covered frontier models can give the government early access for up to 30 days before wider release, and taking part is voluntary.
Applies To
Overview
Signed on 2 June 2026, this presidential action directs the establishment of a classified framework through which the federal government assesses whether advanced AI models meet the threshold for designation as 'covered frontier models' based on their potential cyber capabilities. Developers may voluntarily engage the government for a model designation determination, and developers of designated models can give federal evaluators access for up to 30 days before they release the model to other trusted partners. The order creates no mandatory licensing or pre-clearance. The testing process is classified, meaning developers will be subject to strict confidentiality requirements and must maintain cybersecurity controls suited to handling sensitive government evaluations. The National Security Agency (NSA) is involved in running the cyber assessment part of the order. Participation stays voluntary after designation, and the order sets no penalties for developers who do not take part. The action intersects with existing enterprise obligations around model risk management, incident response, and third-party security requirements for any organization developing or deploying frontier-scale AI systems.
Key Requirements
- •Developers may choose to ask the government whether a model in development is a 'covered frontier model'.
- •The NSA Director makes that determination, consulting the National Cyber Director, CISA, and others.
- •Developers of designated models may give the government access for up to 30 days before release to other trusted partners.
- •Access is subject to confidentiality, cybersecurity, insider-risk, and intellectual property protections.
- •The order creates no licensing, preclearance, or permitting requirement, and sets no penalties for not taking part.
What Your Organization Must Do
- →Confirm with product teams whether any model in development could be considered a covered frontier model.
- →Decide, as a business choice, whether to seek a federal designation determination for a model.
- →Prepare confidentiality, insider-risk, and intellectual property terms before offering any pre-release government access.
- →Brief executives that the order sets no licensing, preclearance, or penalty obligations for developers.
- →Check that research and hosting partners could meet confidentiality terms tied to early access.
- →Track government contracting discussions, since commercial expectations may shift even though participation stays voluntary.
Playbook Guidance
Step-by-step implementation guidance for compliance teams.
Frequently Asked Questions
- Does PAIAIS require all AI developers to submit models for federal review before release?
- No, developers choose whether to seek a designation, and designated developers choose whether to give early access. The order rules out any mandatory licensing, preclearance, or permitting.
- What triggers the 30-day pre-release access requirement under PAIAIS?
- Nothing triggers a requirement, because access is voluntary. Designated developers may offer the government up to 30 days of access before releasing the model to other trusted partners.
- Which federal agency leads the cybersecurity assessment under PAIAIS?
- The NSA Director decides whether a model is a covered frontier model, consulting the National Cyber Director, CISA, and others. The benchmarking process is classified.
- What cybersecurity controls must developers implement to comply with PAIAIS pre-release access requirements?
- Access comes with confidentiality, cybersecurity, insider-risk, and intellectual property protections. The order does not list specific controls for developers.
- What are the penalties for failing to provide pre-release access under PAIAIS?
- There are none: the order sets no penalties for developers who decline to seek designation or give early access. Any downside is commercial, such as in government contracting.
- How does PAIAIS interact with existing model risk management and third-party security obligations?
- The order adds no duties to existing model risk or vendor programs. Developers who take part should check that partners can meet the confidentiality terms that come with early access.